Step Finance Is Dead — So Why Is Its Staking App Still Live? (2026)

Step Finance was Solana's original portfolio dashboard. It is not one any more. The marketing site at step.finance returns a Vercel DEPLOYMENT_NOT_FOUND error, the docs subdomain no longer resolves, and the company announced on 24 February 2026 that it was ceasing all operations after an attacker drained 261,854 SOL from its treasury on 31 January.

Then there is the part nobody has written down. We checked every Step Finance property on 15 October 2026 — 233 days after the wind-down announcement — and app.step.finance is still live. It still loads a staking page. It still says "Connect Wallet". It still advertises 4.88% APY on a validator with 199,584 SOL delegated to it, worth about $21.1 million at today's SOL price. And it still promises that "100% of validator revenue goes towards STEP token buybacks" — for a token whose entire market capitalisation this afternoon is $38,010, and which printed a fresh all-time low at 03:48 UTC this morning.

This article is the status report: what Step Finance was, what the on-chain numbers actually say about the hack, what is still running under the brand today, and which Solana portfolio tracker to use instead. Every figure below was measured on 15 October 2026 and the measurement is named, so you can repeat it.

Step Finance launched in 2021 as a single dashboard for a Solana portfolio. You pasted or connected a wallet and it unpacked everything the chain knew about it: token balances, LP positions broken down into their underlying assets, yield farms, staking, NFTs, and a categorised transaction history. The company's own pitch was coverage of roughly 95% of Solana protocols, and in practice that meant it read positions from the venues a Solana user actually touches — Raydium, Orca, Meteora, Marinade, Kamino, Drift and Jupiter.

That was genuinely useful. Working out what an LP position is worth means decomposing it into two token legs and pricing both, and then reasoning about impermanent loss against simply having held. Doing it by hand across six protocols is miserable. Step did it on one screen, for free.

The company was never only the dashboard. It ran SolanaFloor, a Solana news outlet. It organised the annual Solana Crossroads conference in Istanbul. In December 2024 it acquired Moose Capital, rebranded it Remora Markets, and moved into tokenised equities. It also operated a Solana validator, and — per CoinDesk's reporting — used the validator's earnings to fund buybacks of its own STEP token. The token had a staking wrapper, xSTEP, which paid holders a share of platform revenue.

That last structure matters for everything that follows. A validator, a treasury, a fee wallet and a buyback programme all pointed at one place. So did the keys.

On 31 January 2026, Step Finance disclosed that several of its treasury wallets had been compromised "during APAC hours" by what it called a well-known attack vector. The blockchain security firm CertiK traced the movement: 261,854 SOL unstaked and transferred out, worth roughly $28.9 million at the prices CertiK used at the time. CoinDesk reported the figure as about $27 million. Step's own investigation later put total losses at approximately $40 million.

The cause was not a smart contract. Step's later disclosures, summarised by the security firm Halborn, attributed the breach to compromised devices belonging to the company's executive team — "most likely a social engineering attack." The contracts did what they were written to do. The attacker simply held the keys, or controlled the machine that approved the transactions.

The documented timeline has the drain completing in roughly 90 minutes. That is worth converting into a rate, because the rate is the thing you cannot defend against with a quarterly audit:

Measure	Value
SOL removed	261,854 SOL
Elapsed time (reported)	~90 minutes
Rate	2,909 SOL per minute — 48.5 SOL per second
Rate in dollars (SOL at $117.48)	~$341,800 per minute — ~$5,700 per second
Recovered (Step's statement)	~$3.7M Remora assets + ~$1M other positions

Step credited the partial recovery to Token-2022 protections and coordination with partners. Against a $40 million loss, $4.7 million recovered is 11.75%. Blockchain transparency let everyone watch the money leave in real time. It did not get it back.

One clarification the headlines skipped, because it matters to anyone who ever used the dashboard: the reported losses were Step's own treasury and fee wallets. Step did not report that user wallets were drained, and a read-only portfolio tracker does not hold your tokens in the first place. What Step's users lost was the tool, not their balances. That distinction is the whole argument for non-custodial design, and it cuts both ways — your coins survived, your software did not.

Three different loss figures circulated, and the gap between them confused the story for weeks. It is resolvable with one multiplication. CoinGecko's daily reference price for SOL on 31 January 2026 was $117.4775. So:

• 261,854 SOL × $117.4775 = $30,761,962. That is the SOL leg of the theft, priced at the day's reference rate.
• $40,000,000 − $30,761,962 = $9,238,038. If Step's final figure of ~$40 million is right, roughly $9.2 million of the loss was not SOL — other tokens and positions in the same wallets.
• The lower $27M and $28.9M figures are the SOL leg alone, priced intraday while SOL was falling during a broader market drawdown. They were never in conflict with $40 million; they were measuring a smaller thing at a worse moment.

Two more numbers, because a theft denominated in a volatile asset keeps moving after the headlines stop. SOL trades at $105.65 today. The same 261,854 SOL is now worth $27,664,875 — 10.1% less in dollars than on the day it was taken. The attacker's balance sheet took a haircut too. That is cold comfort, but it is the kind of arithmetic that never appears in the coverage, and it is the reason "$40M hack" is a headline rather than a fact with a fixed value.

Twenty-four days after the breach, Step Finance announced it was ceasing all business operations, effective immediately. The stated reason was not the hole in the balance sheet by itself but the failure to fill it: the team said it had "explored every possible path forward, including financing and acquisition opportunities," and none closed.

The shutdown took the whole group with it — the dashboard, SolanaFloor, and Remora Markets. Two commitments were made on the way out. STEP holders were promised a buyback based on a snapshot of holdings taken before the 31 January exploit. Remora, which the company said had stayed isolated from the incident, was to open a redemption process letting rToken holders swap back to USDC, with all rTokens still backed 1:1. STEP fell a further 36% in the 24 hours after the announcement, having already lost most of its value in January.

So that is the official record: company dissolved, token buyback pending, affiliates closed. Here is what the internet actually serves today.

We requested every Step Finance property we could identify on 15 October 2026. The results are not what a wind-down announcement implies.

Property	Status on 15 Oct 2026	What it serves
step.finance / www.step.finance	HTTP 404	"The deployment could not be found on Vercel. DEPLOYMENT_NOT_FOUND"
docs.step.finance	No connection	Nothing
app.step.finance	HTTP 200 — live	A working staking app with a "Connect Wallet" button, 4.88% APY, and "© 2025 Step Finance" in the footer
remora.markets	No connection	Nothing
solanafloor.com	HTTP 200 — publishing	New articles, the latest timestamped 15 Oct 2026 — not the static archive that was announced

The live staking app is the finding. Its copy, verbatim: "Staking with Step's validator helps support Step Finance communities. 100% of validator revenue goes towards STEP token buybacks, which is distributed to xSTEP stakers as emission-free yield." It offers "Validator Staking 4.88% APY — Stake directly with Step Finance's validator," and it invites you to connect a wallet to do it.

Nothing about that page is obviously broken. The APY it quotes is correct — it matches independent validator data exactly. That is what makes it dangerous rather than merely stale: it is a live, accurate-looking, wallet-connecting interface wearing the brand of a company that announced its own dissolution eight months ago, with a copyright line frozen at 2025 and a marketing site that 404s.

Do not connect a wallet to it. Not because we can show it is hostile — we cannot, and we are not claiming it is — but because the entity that vouched for it does not exist any more, and an orphaned front end is exactly the asset a brand-squatter wants. The general rule is the one that would have saved a lot of people a lot of money: before you sign anything, confirm who is operating the interface. If you cannot answer that, the answer is no. Our guides to hot wallet hygiene and picking a Solana wallet setup both come down to the same habit.

Step's validator is not merely still configured. It is voting, it is healthy, and people are still paying it. Pulled from public validator data at epoch 1058:

Field	Value
Vote account	StepeLdhJ2znRjHcZdjwMWsC4nTRURNKQY8Nca82LJp
Activated stake	199,584.23 SOL — about $21.09M at $105.65
Commission	5% (500 bps); Jito MEV commission 0 bps
Total APY to delegators	4.88% (4.70% staking + 0.18% Jito)
Health	Not delinquent, 100% uptime, 0% skip rate, 99.92% vote success, rank #156
Infrastructure	Agave 4.3.0, Singapore, Vultr (AS20473)
Published website	https://www.step.finance/ — the 404

Three things follow from that table, and all three are arithmetic rather than opinion.

The stake still there is comparable to the stake that was stolen. The attacker removed 261,854 SOL. Delegators are still pointing 199,584 SOL at the same brand's validator — 1.31 times less, same order of magnitude.

The commission is real money. A 4.70% net staking yield after a 5% cut implies roughly 4.95% gross. On 199,584 SOL that is about 494 SOL a year in commission — roughly $52,200 at today's price, flowing to whoever controls the validator's commission account. The economics of Solana validator commission are public and this is a healthy, ordinary validator business.

The buyback promise does not survive contact with the market cap. $21.09 million of delegated SOL is 554 times the entire market capitalisation of the token that "100% of validator revenue" is supposedly buying back. Even if every lamport of commission were spent on STEP, it would be buying an asset the market prices at $38,010 in total.

One honest caveat, and it is important. The validator's own public description now reads: "Originally launched by the Step Finance team, Step Validator is now an independent Solana validator focused on reliable infrastructure, transparent operations, and long-term support for the Solana ecosystem." So by its operator's own account it has been handed off and is no longer Step's. We could not establish who runs it now, and we are not going to guess. But note the contradiction that this creates for anyone arriving from a search engine: the validator says it is independent, the staking app still frames it as Step's and still promises STEP buybacks, and the website both of them point to is a dead deployment. Three sources, three different stories. If you have SOL delegated here, that alone is a reason to review your delegation — and switching validators on Solana costs you nothing but an epoch.

Here is the full state of STEP, measured at 15:05 UTC on 15 October 2026. The mint is StepAscQoEioFxxWGnh2sLBDFp9d8rvKz2Yp39iDpyT and the supply figure below is read straight off a Solana RPC node, not from a listing site.

Metric	Value
Price	$0.00011519
Supply (on-chain)	329,985,279.86 STEP
Market cap	$38,010 — CoinGecko rank #7,308
All-time high	$10.20 on 28 April 2021 — −99.9989%
All-time low	$0.00011403, set 03:48 UTC on 15 October 2026 — today
Change, 30 days / 1 year	−14.4% / −99.76%
On-chain liquidity, all 6 pairs	$28,035 total — $25,353 of it one Raydium STEP/USDC pool
24h volume / trades	$148 across 156 trades

Read those last two rows together, because they describe a market that has effectively stopped. Total liquidity equals 73.8% of the market cap — in a functioning market the float dwarfs the pools; here they are nearly the same size, which means there is almost no token held anywhere that is not already sitting in a pool. Daily volume is 0.37% of market cap: $148 of turnover, in 156 trades averaging under a dollar each. The thinnest of the six pairs holds $1.06 of liquidity. If you own STEP, what you own is a position you cannot exit at anything resembling the quoted price — the same slippage problem every illiquid token has, with no buyer of last resort.

Two comparisons put the scale beyond argument. The 329,985,280 STEP that exist today would have been worth $3.37 billion at the April 2021 peak price; they are worth $38,010 now. And the $40 million taken from the treasury in January is 1,052 times the token's entire present market cap — the hack was three orders of magnitude larger than the thing it killed.

On the promised buyback: Step said in February that it was working on one, priced off a pre-exploit snapshot, with details to follow. We are not going to assert that it never happened, because we cannot see a buyback from the outside. What we can see is that 233 days later the token set a new all-time low this morning and is trading 1.02% above it. Whatever has or has not been executed, no floor is visible in the price.

The most useful thing about the Step Finance hack is how boring the attack was. Step had audited contracts, a bug bounty, and published security reviews. None of it was bypassed, because none of it was relevant. The contracts behaved correctly from the first block to the last. The attacker got onto an executive's laptop and used the signing authority that laptop legitimately had.

That pattern is the dominant one now, and it has a specific shape worth internalising:

• The audited surface and the attacked surface are different surfaces. An audit scopes code. The 31 January incident happened in the gap between a human, a device and a signing key — a perimeter no contract audit covers and no bug bounty rewards.
• Multisig is a mitigation, not a cure. It raises the number of devices an attacker must own. If approvals are routinely rubber-stamped on laptops that also read email, it raises the bar less than the org chart suggests.
• Speed is asymmetric. 48.5 SOL a second out versus a human incident response measured in minutes is not a fair fight. There is no human-speed defence; the defence has to be structural, in the form of keys that simply cannot move everything.
• The same logic applies at your scale. A hardware wallet does not stop you from signing a malicious transaction, but it does mean the key never sits on the machine that opens attachments. That is the entire argument for a cold wallet for balances you are not trading, with a separate hot wallet for the float — the split we recommend in our Solana wallet guide and the reason dedicated signing hardware is worth the money.

There is also a plainer lesson for anyone who builds a workflow on a third-party tool. Step was not a scam. It shipped a good product for five years, and it still died in three weeks, taking the dashboard, the news site and the tokenised-equities venture with it. Tool risk is a real risk, and the way to price it is to ask what breaks if the vendor disappears on a Tuesday. If the answer is "my records", export them. If the answer is "my money", the tool should never have been able to touch your money.

We checked these on 15 October 2026. The short answer for a Solana portfolio is Jupiter Portfolio, and the reason is slightly funny: it is built by the team behind Sonar Watch, which was Step Finance's closest competitor until Jupiter acquired it in January 2025. Both of the original Solana-native dashboards are gone as independent products. One of them had a soft landing.

Tool	Use it for	Notes
Jupiter Portfolio	The direct replacement — Solana DeFi positions, LPs, staking, history	jup.ag/portfolio, live today. Documents 190+ protocols. Read-only: paste any address, no wallet connection needed. Built by the Sonar Watch team
Solscan	Ground truth on a single wallet, token or transaction	An explorer, not a dashboard. Use it when you need to verify what a tracker is telling you
DeBank	Multi-chain net worth, mostly EVM	Live. Strong outside Solana, weaker on Solana-native protocol depth
Birdeye	Token-level charts, liquidity and pair data	Market data rather than portfolio accounting — see also the alternatives
Wallet trackers	Watching other people's wallets, not your own	A different job entirely, and the one that actually changes what you buy

Two migration notes. First, Jupiter Portfolio being read-only on a pasted address is a feature, not a limitation — after the year Solana has had, a dashboard that never needs a signature is strictly safer than one that does. Second, if you used Step for tax records, pull your history now from an explorer rather than hoping an orphaned front end keeps serving it; the fee and transaction detail you need is on-chain forever even when the UI is not.

Worth saying plainly, because it explains why so many people had a beautiful Step Finance dashboard and a bad year: a portfolio tracker is a rear-view mirror. It renders decisions you already made. It priced your LP position after you entered it, showed your staking yield after you delegated, and totalled your memecoin bags after you bought them. At no point did it improve a single entry.

The thing that moves the number on a dashboard is execution — what you buy, when, and how fast. On Solana that is usually a question about other people's wallets rather than your own, which is why following smart money and copying what good traders do tends to beat optimising your own screen time. Copy trading is just that idea automated: pick a trader with a verifiable record, mirror their entries and exits, stop trying to out-click the market at 3am.

That is what uwuu does. You connect your wallet at uwuu.ai, pick a trader from a verified on-chain leaderboard — every position auditable on the chain, not a screenshot — and your wallet mirrors their trades with sub-400ms execution. It is non-custodial: the keys never leave your wallet, which is precisely the property Step Finance's own treasury did not have in January. Smart trade filtering screens out the entries you do not want to copy, setup takes about two minutes, and the fee is performance-based — uwuu charges only when you profit. Before you commit capital, read our honest take on what can go wrong with copy trading and whether it is actually profitable; and if you want the full landscape first, start with the best Solana trading bot comparison or the platform-by-platform breakdown.

Is Step Finance shut down?

Yes. Step Finance announced on 24 February 2026 that it was ceasing all business operations, including SolanaFloor and Remora Markets, after failing to secure financing or an acquisition following the January hack. As of 15 October 2026 the main site at step.finance returns a 404 and the docs subdomain does not resolve. The app.step.finance staking page is still online, but the company that stood behind it is not.

What happened to Step Finance?

On 31 January 2026 attackers compromised devices belonging to Step Finance executives — reportedly through social engineering — and used the resulting signing access to unstake and drain 261,854 SOL from the company's treasury and fee wallets in roughly 90 minutes. CertiK valued the SOL at about $28.9 million at the time; Step's own investigation put total losses near $40 million. It was not a smart contract exploit. The company wound down 24 days later.

Is Step Finance safe to use now?

Do not connect a wallet to anything carrying the Step Finance brand. The staking page at app.step.finance is still live and still invites wallet connections, but the operating company dissolved in February 2026, its footer still reads 2025, and the website it links to is a dead deployment. We have no evidence the page is malicious — but an orphaned front end for a wound-down brand is not something to sign transactions against. If you cannot identify who operates an interface, do not connect to it.

What is the STEP token worth?

At 15:05 UTC on 15 October 2026, STEP traded at $0.00011519 for a total market cap of $38,010 across 329,985,280 tokens, ranked #7,308 by CoinGecko. That is 99.9989% below its April 2021 all-time high of $10.20, and it set a fresh all-time low of $0.00011403 earlier the same morning. Total on-chain liquidity across all six pairs is about $28,035, with $148 of volume in the last 24 hours.

Did Step Finance users lose their crypto?

The reported losses were Step's own treasury and fee wallets, and Step did not report that user wallets were drained. A read-only portfolio dashboard never held user tokens in the first place, so users lost access to the tool rather than their balances. STEP token holders are a separate matter — the token lost most of its value and a promised pre-exploit-snapshot buyback has not put any visible floor under the price.

What is the best Step Finance alternative for Solana?

Jupiter Portfolio at jup.ag/portfolio is the closest like-for-like replacement: it documents coverage of 190+ Solana protocols and it is built by the Sonar Watch team that Jupiter acquired in January 2025. It is read-only on any pasted address, so you can use it without connecting a wallet. Pair it with Solscan when you need to verify a specific transaction, and with a DeFi wallet tracker if you want to watch other wallets rather than your own.

Is the Step Finance validator still running?

Yes. At epoch 1058 on 15 October 2026 the validator at vote account StepeLdhJ2znRjHcZdjwMWsC4nTRURNKQY8Nca82LJp had 199,584.23 SOL delegated to it — about $21.09 million — charging 5% commission, not delinquent, 100% uptime, ranked #156. Its own public description now says it is an independent validator rather than Step's, though the website it publishes is the dead step.finance domain. If you have SOL delegated there, it is worth reviewing where it points.